Twenty-year-old 'latent defect' in software caused December air-traffic control shutdown

Defect identified in software had been present since it was written in the 1990s

The interim report into the failure of the National Air Traffic Services (NATS) computer systems on 12 December has revealed that an erroneous line of code, combined with the unforeseen impact of an update performed in November, caused the shutdown of UK airspace, throwing air traffic into chaos.

As a result, the computer systems that track aircraft over UK airspace went down for 45 minutes, UK airspace was closed to new traffic, and air-traffic controllers had to adopt a manual system for managing the existing aircraft in the skies over the UK.

According to the report, a combination of three factors caused the shutdown:

• A latent defect in the SFS [System Flight Server] software that investigators believe has been present since the software was written in the 1990s;
• A system change made in November 2014 to increase the number of available "atomic functions" [unique identifiers];
• An incorrect (but valid from the computer system's programming) action applied during the routine splitting of two air traffic control sectors, which put a workstation into "watching mode" rather than "elected mode".

The latent software defect, the report adds, was an incorrect check of the maximum number of atomic functions, which the system change in November 2014 had erroneously reduced from a maximum of 193 to 151. When the system performed a validating check when it was switched to "watching mode", this caused the system to shutdown as a precaution.

"When trying to validate the request to enter 'watching mode', the primary SFS [System Flight Server] believed that it had more active Atomic Functions than the maximum capacity, a situation that should not be allowed to occur. When an error of this kind occurs SFS is programmed to shut down in order to prevent the risk of supplying corrupt data to controller workstations," explained the report.

The full investigation will report in May and will cover the software architecture choices made by NATS, as well as the full circumstances leading up to the IT failure, as well as the actions taken to recover the systems.